Between 10 and 13 November 2025, Europol coordinated the latest phase of Operation Endgame from its headquarters in The Hague, targeting some of the largest cybercrime infrastructures worldwide. The operation focused on the infostealer Rhadamanthys, the Remote Access Trojan VenomRAT, and the botnet Elysium, all critical tools used in international cybercrime. During the operation, authorities successfully took down these cybercrime enablers, and the main suspect behind VenomRAT was arrested in Greece on 3 November 2025.

The dismantled infrastructure had infected hundreds of thousands of computers globally, harvesting millions of credentials without victims’ knowledge. The VenomRAT suspect reportedly had access to over 100,000 cryptocurrency wallets, potentially worth millions of euros.

Scope of the operation

Operation Endgame is an ongoing collaboration between law enforcement and judicial authorities from Australia, Belgium, Canada, Denmark, France, Germany, Greece, Lithuania, the Netherlands, the UK, and the United States. It also involves over 30 public and private partners, including Cryptolaemus, Shadowserver, RoLR, Spycloud, Cymru, Proofpoint, Crowdstrike, Lumen, Abuse.ch, HaveIBeenPwned, Spamhaus, DIVD, Trellix, and Bitdefender, contributing intelligence, forensic expertise, and malware analysis.

Operational coordination

Europol’s command post facilitated the operation by enabling cross-border intelligence exchange, providing crypto-tracing and forensic support, and coordinating operational calls and sprints. Over 100 law enforcement officers from participating countries were involved in the planning and execution. Eurojust assisted with European Arrest Warrants and European Investigation Orders, ensuring legal coordination across jurisdictions.

Targeted actions

Authorities not only dismantled the criminal servers but also engaged directly with criminal users of the infostealers, requesting cooperation and information via the Operation Endgame Telegram channel. Criminal services that failed were exposed through the Operation Endgame website.

Participating authorities

The operation reflects international law enforcement cooperation at its highest level, effectively neutralizing major cybercrime infrastructure and safeguarding victims worldwide.